# Access dynamic field
**URL:** https://discuss.elastic.co/t/access-dynamic-field/165997
**Category:** Logstash
**Created:** [January 28, 2019, 12:39pm UTC](https://discuss.elastic.co/t/access-dynamic-field/165997 "2019-01-28T12:39:03Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@imaad](https://discuss.elastic.co/u/imaad)
#### Post date: [January 28, 2019, 12:39pm UTC](https://discuss.elastic.co/t/access-dynamic-field/165997/1 "2019-01-28T12:39:03Z")
Hello,
In my event, I have a field "end\_date\_null\_count" =\> 7 and then I use the mutate plugin to add another field "last\_null\_value" =\> "column7" :
```
mutate {
add_field => {"last_null_value" => "column%{end_date_null_count}"}
}
```
My goal is to be able to access to this dynamic field ("last\_null\_value") in my Grok filter plugin :
```
grok {
match => ["[end_date_null][%{last_null_value}]", "%{TIMESTAMP_ISO8601:timestamp_last} %{GREEDYDATA:definition_last} \[%{LOGLEVEL:log_level_last}\] %{GREEDYDATA:operation_type_last} : %{GREEDYDATA:msg_last}"]
}
```
Using this syntax give me a "\_grokparsefailure" I have tried another syntax [end\_date\_null.%{last\_null\_value}] but but seems that it's not working within the grok filter
end\_date\_null field :
```
"end_date_null" => {
"column2" => "2018-12-13T11:41:44.846+0000 Regulatory [INFO] Transaction : VALIDATE,qf16ft787bif1xs1iuoqihwi9,null,100002506,13-12-2018,13-12-2018T11:41:42.447+0000,null,Payment Order,Date not a working day",
"column3" => "2018-12-13T12:07:41.644+0000 Regulatory [INFO] Transaction : VALIDATE,007069643021retfed8ar2w4ugvgz1n9xsuz,0070696430.2,100002506,13-12-2018,13-12-2018T12:07:39.905+0000,null,Payment Order,None",
"column4" => "2018-12-13T13:13:22.449+0000 Regulatory [INFO] Transaction : VALIDATE,0004961017bb48fydx3gvq1dopa7tujzoya,0004961017,100002506,13-12-2018,13-12-2018T13:13:21.700+0000,null,Payment Order,Invalid end date",
"column5" => "2018-12-13T13:51:13.164+0000 Regulatory [INFO] Transaction : VALIDATE,0004961017121v2xs7x08f975bswzkiv5nona,0004961017.12,100002506,13-12-2018,13-12-2018T13:51:11.773+0000,null,Payment Order,None",
"column7" => "2018-12-13T13:54:40.123+0000 Regulatory [INFO] Transaction : VALIDATE,007069643021v2xs7x08f975bswzkiv5nona,0070696430.2,100002506,13-12-2018,13-12-2018T13:54:40.469+0000,null,Payment Order,None",
"column1" => "2018-12-13T11:46:13.654+0000 Regulatory [INFO] Transaction : VALIDATE,FT18260HNC8R1bbcffrlnrt21x8awmxhtjfdz,FT18260HNC8R,100002506,13-12-2018,13-12-2018T11:46:13.243+0000,null,Payment Order,Date not a working day",
"column6" => "2018-12-13T13:51:17.146+0000 Regulatory [INFO] Transaction : PROCESS,0004961017121v2xs7x08f975bswzkiv5nona,0004961017.12,100002506,13-12-2018,13-12-2018T13:51:16.819+0000,null,Payment Order,None"
}
```
Can anyone help me to find the right syntax?
Thank you
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 28, 2019, 2:26pm UTC](https://discuss.elastic.co/t/access-dynamic-field/165997/2 "2019-01-28T14:26:42Z")
I cannot get a sprintf reference to work there, but you could do it using ruby.
```
ruby {
code => '
wanted = event.get("last_null_value")
event.get("end_date_null").each { |k, v|
if k == wanted then
event.set("[@metadata][wanted]", v)
end
}
'
}
```
You are using an unanchored grok pattern with three GREEDYDATA fields. That's going to be really expensive. You might do better with
```
grok {
match => ["[@metadata][wanted]", "^%{TIMESTAMP_ISO8601:timestamp_last} %{NOTSPACE:definition_last} \[%{LOGLEVEL:log_level_last}\] (?[^:]+) : %{GREEDYDATA:msg_last}"]
}
```
---
### Author:  [@imaad](https://discuss.elastic.co/u/imaad)
#### Post date: [January 28, 2019, 2:39pm UTC](https://discuss.elastic.co/t/access-dynamic-field/165997/3 "2019-01-28T14:39:05Z")
Thank you @Badger, That works very fine for me.
I changed also the grok pattern.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 25, 2019, 2:49pm UTC](https://discuss.elastic.co/t/access-dynamic-field/165997/4 "2019-02-25T14:49:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.